130 lines
5.2 KiB
Plaintext
130 lines
5.2 KiB
Plaintext
[[managing-fields]]
|
|
== Managing Fields
|
|
|
|
The fields for the index pattern are listed in a table. Click a column header to sort the table by that column. Click
|
|
the *Controls* button in the rightmost column for a given field to edit the field's properties. You can manually set
|
|
the field's format from the *Format* drop-down. Format options vary based on the field's type.
|
|
|
|
You can also set the field's popularity value in the *Popularity* text entry box to any desired value. Click the
|
|
*Update Field* button to confirm your changes or *Cancel* to return to the list of fields.
|
|
|
|
Kibana has field formatters for the following field types:
|
|
|
|
* <<field-formatters-string, Strings>>
|
|
* <<field-formatters-date, Dates>>
|
|
* <<field-formatters-geopoint, Geopoints>>
|
|
* <<field-formatters-numeric, Numbers>>
|
|
|
|
[[field-formatters-string]]
|
|
=== String Field Formatters
|
|
|
|
String fields support the `String` and `Url` formatters.
|
|
|
|
include::field-formatters/string-formatter.asciidoc[]
|
|
|
|
include::field-formatters/url-formatter.asciidoc[]
|
|
|
|
[[field-formatters-date]]
|
|
=== Date Field Formatters
|
|
|
|
Date fields support the `Date`, `Url`, and `String` formatters.
|
|
|
|
The `Date` formatter enables you to choose the display format of date stamps using the http://moment.js[moment.js]
|
|
standard format definitions.
|
|
|
|
include::field-formatters/string-formatter.asciidoc[]
|
|
|
|
include::field-formatters/url-formatter.asciidoc[]
|
|
|
|
[[field-formatters-geopoint]]
|
|
=== Geographic Point Field Formatters
|
|
|
|
Geographic point fields support the `String` formatter.
|
|
|
|
include::field-formatters/string-formatter.asciidoc[]
|
|
|
|
[[field-formatters-numeric]]
|
|
=== Numeric Field Formatters
|
|
|
|
Numeric fields support the `Url`, `Bytes`, `Duration`, `Number`, `Percentage`, `String`, and `Color` formatters.
|
|
|
|
include::field-formatters/url-formatter.asciidoc[]
|
|
|
|
include::field-formatters/string-formatter.asciidoc[]
|
|
|
|
include::field-formatters/duration-formatter.asciidoc[]
|
|
|
|
include::field-formatters/color-formatter.asciidoc[]
|
|
|
|
The `Bytes`, `Number`, and `Percentage` formatters enable you to choose the display formats of numbers in this field using
|
|
the https://adamwdraper.github.io/Numeral-js/[numeral.js] standard format definitions.
|
|
|
|
[[scripted-fields]]
|
|
=== Scripted Fields
|
|
|
|
Scripted fields compute data on the fly from the data in your Elasticsearch indices. Scripted field data is shown on
|
|
the Discover tab as part of the document data, and you can use scripted fields in your visualizations.
|
|
Scripted field values are computed at query time so they aren't indexed and cannot be searched using Kibana's default
|
|
query language. However they can be queried using Kibana's new <<kuery-query, experimental query language>>. Scripted
|
|
fields are also supported in the filter bar.
|
|
|
|
WARNING: Computing data on the fly with scripted fields can be very resource intensive and can have a direct impact on
|
|
Kibana's performance. Keep in mind that there's no built-in validation of a scripted field. If your scripts are
|
|
buggy, you'll get exceptions whenever you try to view the dynamically generated data.
|
|
|
|
When you define a scripted field in Kibana, you have a choice of scripting languages. Starting with 5.0, the default
|
|
options are {ref}/modules-scripting-expression.html[Lucene expressions] and {ref}/modules-scripting-painless.html[Painless].
|
|
While you can use other scripting languages if you enable dynamic scripting for them in Elasticsearch, this is not recommended
|
|
because they cannot be sufficiently {ref}/modules-scripting-security.html[sandboxed].
|
|
|
|
WARNING: Use of Groovy, JavaScript, and Python scripting is deprecated starting in Elasticsearch 5.0, and support for those
|
|
scripting languages will be removed in the future.
|
|
|
|
You can reference any single value numeric field in your expressions, for example:
|
|
|
|
----
|
|
doc['field_name'].value
|
|
----
|
|
|
|
For more background on scripted fields and additional examples, refer to this blog:
|
|
https://www.elastic.co/blog/using-painless-kibana-scripted-fields[Using Painless in Kibana scripted fields]
|
|
|
|
[float]
|
|
[[create-scripted-field]]
|
|
=== Creating a Scripted Field
|
|
To create a scripted field:
|
|
|
|
. Go to *Management > Kibana > Index Patterns*
|
|
. Select the index pattern you want to add a scripted field to.
|
|
. Go to the pattern's *Scripted fields* tab.
|
|
. Click *Add scripted field*.
|
|
. Enter a name for the scripted field.
|
|
. Enter the expression that you want to use to compute a value on the fly from your index data.
|
|
. Click *Create field*.
|
|
|
|
For more information about scripted fields in Elasticsearch, see
|
|
{ref}/modules-scripting.html[Scripting].
|
|
|
|
[float]
|
|
[[update-scripted-field]]
|
|
=== Updating a Scripted Field
|
|
To modify a scripted field:
|
|
|
|
. Go to *Management > Kibana > Index Patterns*
|
|
. Click the index pattern's *Scripted fields* tab.
|
|
. Click the *Edit* button for the scripted field you want to change.
|
|
. Make your changes and then click *Save field* to update the field.
|
|
|
|
WARNING: Keep in mind that there's no built-in validation of a scripted field. If your scripts are buggy, you'll get
|
|
exceptions whenever you try to view the dynamically generated data.
|
|
|
|
[float]
|
|
[[delete-scripted-field]]
|
|
=== Deleting a Scripted Field
|
|
To delete a scripted field:
|
|
|
|
. Go to *Management > Kibana > Index Patterns*
|
|
. Click the index pattern's *Scripted fields* tab.
|
|
. Click the *Delete* button for the scripted field you want to remove.
|
|
. Click *Delete* in the confirmation window.
|